4.8. Disk Managment.

In this section we are going to discuss every thing about block devices such as hard disks and RAID system, what does file system mean, types of formating and how to optimize them for best speed, reliability or security.

Section quote:

• "I recall hearing that highly-classified data must be destroyed by physically shredding the medium. Yes, throw your disk drive in the shredder!"
      -- Mark Wood on Linux Kernel Mailing Lists

Section contents:

• 4.8.1. File systems introduction.
• 4.8.2. Low level format.
• 4.8.3. Partitioning.
• 4.8.4. Formating.
• 4.8.5. Checking file system consistency.
• 4.8.6. Security.
• 4.8.7. Raw disk images.
• 4.8.8. Compressed file systems.
• 4.8.9. Encrypted file systems.
• 4.8.10. Logical Volume Management (LVM).
• 4.8.11. Redundant Array of Indepenant Disks (RAID).

4.8.1. File systems introduction.

Linux can handle many file systems, because it depends on a general abstraction called Virtual File System (VFS) which can be easy support new file systems for example using loadable modules, if you need to use some file system load it's modem (with modprobe), Linux support pseudo file systems like 'proc'. Linux 2.2 had a limit for maximum file system size upto 2 TB (2048 GB), in recent versions too much larger sizes are supported.

Tip

If you define a '_FILE_OFFSET_BITS=64' macro, then 'gcc' will transparently replacy usual standard C file functions with LFS functions which that can handle files larger than 2GB (and file systems larger than 2TB), for example 'gcc -d _FILE_OFFSET_BITS=64 myfile.c -o myfile'.

bash# mkswap /dev/hdb7
bash# swapon /dev/hdb7

bash# mkswap if=/dev/zero of=/swapfile bs=1m count=32
bash# mkswap /swapfile
bash# swapon /swapfile

bash# swapoff /swapfile

disks and partitions are block devices, notice the 'b' to left of file mode, for example see the output of 'ls -l /dev/hda'. This mean that the data are divided into fixed size structure called block or cluster (for example, each is 512 byte in size), unlike character devices which reads one byte at a time as in keyboards and terminals. With block devices you could block number so and so without passing previous blocks, you could read blocks in reversed order. This mean that disks is like numbered pigeonholes (or P.O.Boxes), get what's on box number so and so ... put this at box numbered so and so, people don't like numbers (it's difficult to remember) and usually files do not have the smae size as blocks, this is why file system for, it's a logical process to locate those numbers as assigned to some file, some boxes(blockes) are used as index we keep information about file (it's name,date,size,first block number) at the block related with the content of this file we keep part of file content and next block number (and the rest part of the file and so on), the structure of blockes,index,filenames,...etc is called file system, and the process of applying a file system on device called formating.

Tip

If you added one byte to a file, the free space could stay the same, and could decrease by more than one byte, if you create a new one byte file tthe hard disk free space decreases by one block size.

There are sets of tools to deal with each file system, for example mkfs.msdos, mkfs.minix, ..., fsck.minix ...etc. the first part is tthe task of the tool and second part is the file system it could handle. The new Linux native file system is 'ext3' (a journaling version that is backward and upward compatible with 'ext2'), also you could use 'reiserfs','jfs' (IBM journaling file system) and 'xfs' (released by SGI under terms of GPL), using the last one you could put 32 million file on one folder, and it support large files upto many TB, see 'http://oss.sgi.com/projects/xfs', the file system suitable for floppies (rescue disks) is 'minix', and the suitable for initial ram disks is the native old 'ext2' because it needs no modules and ram disk needs no journaling (this will save some space), also if 'minix' support is built into the kernel then it could be used for initial ram disk. Since 'ext3' is compatible with 'ext2' that last one tools could used with the first (should I say the third). We have a file system called 'msdos' that is FAT used in dos and windows but the 8.3 filenaming style (12 characters, no spaces, 8 characters followed by '.' then 3 charactters), an extention to it is called 'vfat' which supports long filenames and spaces, although this improvements to FAT, it's not a journaling file system, it have no links, no device files, no modes (permissions), FIFO. For all those reasons you can't install Linux on 'msdos' or 'vfat' file systems, but there is a file system called 'umdos' that fill the missing features of FAT, it could be used to install Linux on FAT. We will concentrate on 'ext3' (or 2), it won't be difficult to find your way with other file systems.

4.8.2. Low level format.

Like infrastructure of a city, the disk making factories give each disk another kind of format, where it specify and prepare sectors number and size (they are not sector shaped, only arces with fixed angles is called sectors in this context) and tracks (circles with valid raduis for sectors), in other words low level format is to specify where each byte is located and prepare it. This process is done by tthe factory as we said before, but you can do it again yourself for a floppy (as far as I know there is no such tool for hard disk) using something like this:

bash# fdformat /dev/fd0u1440

bash# fdformat /dev/fd0u1760

Linux is so advanced, it does not depend on BIOS to handle disks, for example is you did not declare(nor use autodetect) the hard disk on BIOS setup, and set it to 'none', Linux could access it, Windows or LILO/GRUB will not work if BIOS settings of hard disk is invalid. BIOS hard disk settings is to specify the number of cylinders, heads and sectors, this is called CHS (also sometimes you need to specify tracks), those values are written on the back of the disk, some BIOSs offer autodetect once (it's faster than autodetect on each POST each time you turn on your computer), and Linux could detect them:

bash# dmesg | grep 'hd[a-d]:.*CHS'

4.8.3. Partitioning.

We have said at installing section that we have 3 advantages for partitioning those are:

• you can handle(check,format,...etc) each partition alone, this will save time for example if you have an 80 GB, having a problem on a 20 GB partition you only check those alone.
• overcoming file system limitation on some it's size, for example largest FAT16 disk size is 2GB and for FAT32 is 2TB, separating the disk into partations each could be upto the limit.
• each partition could have different file system and it could have it's own boot record, so you could install many OSs.

Some partitioning programs are easy and others are complicated, easy GUI partitioning tools like 'diskdrake' (Mandrake), 'diskdruid' (RedHat), and 'cfdisk' which is an easy console program, to use it move with up and down arrows to select a partition, left and right to select operation. On the other hand we have 'fdisk' the most ugly difficult utility, after you run it you could type a command letter at it's prompt:

bash# fdisk -l /dev/hda
display a report
bash# fdisk /dev/hda
Command (m for help): m
Command action
   a   toggle a bootable flag
   c   toggle the dos compatibility flag
   d   delete a partition
   l   list known partition types
   m   print this menu
   n   add a new partition
   o   create a new empty DOS partition table
   p   print the partition table
   q   quit without saving changes
   t   change a partition's system id
   u   change display/entry units
   v   verify the partition table
   w   write table to disk and exit
   x   extra functionality (experts only)

Tip

If you have Windows or DOS then the partitioning philosophy is like this: the first one 'hda1' is primary partition with bootable flag, then upto two other primary partitions (without bootable flag), then an extended partition that take the rest of the disk space, if we have only one primary partition then the extended will be 'hda2', this partition is not usable (you can't mount it), then logical partition comes on this extended partition, in other words partitions from 1 to 4 are primary or extended, the rest are logical, you could have 4 primary partitions but you can't add more than that, but if you have 3 primary you could add extended and many logical partitions inside it, only one primary could be bootable (need not the first).

Warning

You should not modify the partition table of any mounted device, for example to change the partition of your root file system use rescue disk or a Live CD.

resizing a partition with 'fdisk' by removing it and adding a new one with different size, will case data loss, on the other hand 'GNU parted' is the answer! it could edit (create,remove,..etc) partition table and it can resize partition without losing data (this applies to FAT and 'ext2'), 'parted' could be used silently as a back end by scripts or GUI programs using '-s' option, for example 'parted -s /dev/hda resize 1 0 1023' will resize the first partition of 'hda' to start from zero and end at 1023 (in MB), but using '-i' option run on interactive mode (the default mode), for example type 'parted -i /dev/hdb' to start partitioning 'hdb'.

Warning

'parted' apply changes as you type them, unlike 'fdisk' you can NOT play with it then exit without saving.

bash# parted /dev/hdb
 GNU parted X.YY.ZZ
	WARNING ....
(parted) print
    Minor    Start    End      Type            Filesystem     Flags
    1          0.0    5010.7   primary         FAT            boot
(parted) help
    ...
(parted) help check
    ...
(parted) check 1
(parted) resize 1 0 1023
(parted) print
    Minor    Start    End      Type            Filesystem     Flags
    1          0.0    1023     primary         FAT            boot
(parted) mkpart primary ext2 1023 5010.7
(parted) print
    Minor    Start    End      Type            Filesystem     Flags
    1          0.0    1023     primary         FAT            boot
    2         1023    5010.7   primary         ext2

Warning

Before you resize a partition you should check it with 'dosfsck' or 'e2fsck' for 'FAT' and 'ext2' respectively, then check it inside 'parted' with 'check' folloed by partition number, also you should convert 'ext3' to 'ext2'.

Tip

If you have large disk (larger than 2GB), then you should enable 'LBA' flag on 'BIOS' (if there is no such option then it's on by default), and on partition table for each FAT partitions (so that Windows and DOS works properly), you could use 'parted' to set this flag on with something like 'set 1 lba on' this will turn LBA for first partition.

4.8.4. Formating.

If you have a floppy you want to format (this will erase all data) type:

bash# mkdosfs -v /dev/fd0u1440

Warning

This mean that data could be restored after formating if they were not overwritten (like shred paper with much glue), don't depend on that you can restore the data but know that a cracker with time and filters could find what he is looking for, if you have data and you want them to disappear before you format that partition issue:
'dd if=/dev/zero of=/dev/hdb1 bs=1m'.

bash# mke2fs -v /dev/hda7

bash# mke2fs -Cv /dev/hda7

bash# tune2fs -j /dev/hda7

Warning

Before you do conversion from 'ext3' to 'ext2', you should unmount it or at least mount it as read only, 'mount /dev/hda7 -o remount,ro' and make sure it's successfully set a read only, notice 'ro' on options field, then you could use 'tune2sf'.

4.8.5. Checking file system consistency.

To check a device we use 'fsck' which could autodetect file system type, and then call the specific tool to check thatt file system. You also could use the file system specific tool (like 'e2fsck' for 'ext2')

Warning

Before you check any thing you should unmount or at least remount as read only, with something like 'mount /dev/hda7 -o remount,ro' then make sure it's so with 'mount' with no arguments.

bash# e2fsck /dev/hda7
e2fsck: /dev/hda7 is clean
bash# 

fix [yn]: 

We have said that 'fsck' could case loss of data (files) due to file system inconsistency (eg. bacause of bad system shutdown), those lost files than could not be identified will be saved on '/lost+found', some of them could have no names (names as it's nodes numbers), it's upto you move them to their places.

4.8.6. Security.

At a previous warning we have said that formated deviced could be restored because it's not (...) as one could imagine, the same way deleted files could be restored, I'm not saying so to encourage you to delete file when you are NOT sure nor to give you hope it could be restored, but to warn that when you remove sensitive file (like passwd) it could be restored by someone. To see that you self run 'mc' and type 'cd /#undel:hda7' then you could see a folder with all deleted files on 'hda7' (their names will be just numbers), press F3 to view it, and restotre the file by coping it somewhere else.

Then how to erase files once and for all ? think of a solution ? let's assume you have a 1MB file called 'mysecrit', then try:

bash# dd if=/dev/zero of=mysecrit bs=1k count=1024
1024+0 records in
1024+0 records out
bash# rm mysecrit

bash# dd if=/dev/urandom of=mysecrit bs=1k count=1024
1024+0 records in
1024+0 records out
bash# sync
bash# rm mysecrit

Tip

'sync' is a tool used to force the system to physically write all what in buffer/cache, it's useful to be used once you feel there something wrong going to happen (eg. just before a system crash) then all scheduled writing requests will be physically written, so next booting check few damage will be lost.

bash# shred mysecrit

4.8.7. Raw disk images.

Do you have ISO files (CDROM raw images) ? you could access those files without burning it on CD!! you could mount the images using loop back device, to set a loop back device to point to the image and mount it use:

bash# mount -o loop,ro /home/ahmad/cd_image.iso /mnt/cdrom

bash# losetup /dev/loop0 /home/ahmad/cd_image.iso
bash# mount -o ro /dev/loop0 /mnt/cdrom

bash# umount /dev/loop0
bash# losetup -d /dev/loop0

You could create a raw image of a disk that need not be an ISO, by taking a sanpshot of a real device with 'dd', passing the device as input file and the image file as output

bash# dd if=/dev/hdb1 of=/misc/hdb1.img.vfat bs=4K

bash# dd if=/dev/zero of=/misc/img.ext2 bs=1M count=32
32+0 records in
32+0 records out
bash# mke2fs -v /misc/img.ext2
mke2fs: /misc/img.ext2 is not block device, continue ? y

4.8.8. Compressed file systems.

You could convert any directory tree to a compressed disk image then mount it as loop back device and use it, an example of this is 'cramfs' after creating this file system you can only mount it for read only use, it's amazing how fast it is! This is en example how to generate such file and mount it,

bash# mkfs.cram -v /home/ali/mytree /misc/img.cram
bash# mount -o loop,ro -t cramfs /misc/img.cram /mnt/cramfs

4.8.9. Encrypted file systems.

Again, the answer is loop back device, using '-e' option when you call 'losetup' followed by encryption method like 'twofish', 'blowfish', 'cast128', 'serpent' and 'aes', to see currently loaded enryption modules view '/proc/crypto', to add more encryption modules use 'insmod' or modprobe followed by module base name (with no extention) than is found on '/lib/module' then kernel version then..., The Loopback-Encrypted-Filesystem-HOWTO suggests 'serpent' encryption but more recent documentations suggest 'aes' which is an encryption method approved by NIST, this is an example discuss how to create and mount a 64MB encrypted loop back device using 'aes' method, use: (the first command is to make sure loop0 is not used)

# losetup /dev/loop0
/dev/loop0 does not exists
# dd if=/dev/zero of=/misc/secrit bs=1M count=64
64+0 records in
64+0 records out
# losetup -e aes-256 /dev/loop0 /misc/secrit
password:*******
# mke2fs /dev/loop0
# losetup -d /dev/loop0

Tip

You could pass the pasword using a pipe '|' or file with '<'.

# losetup -e aes /dev/loop0 /misc/secrit
password:*******
# mount -t ext2 -o rw /dev/loop0 /mnt/secrit

# umount /mnt/secrit
# losetup -d /dev/loop0

# losetup -e aes /dev/loop0 /misc/secrit < /mnt/flash/mykey 

a cracker could now that it's encrypted then he start to guess password. A trick to fool crackers using an encrypted file system that has some nenrypted pseudo files that the cracker thing there is no more files (when he mount it with no password it mount usually but no sensitive files) using Steganographic File System see http://stegfs.sf.net.

4.8.10. Logical Volume Management (LVM).

Logical Volume Management(LVM) is meant to group devices (partitions/disks) appears tto be one disk, you could add a new disk and it will add free space to LVM virtual disk, not to just the mount point of the newly added disk, see LVM-HOWTO by AJ Lewis <alewis(at)redhat(dot)com> Copyrighted by Sistina Software, Inc.

4.8.11. Redundant Array of Indepenant Disks (RAID).

Redundant Array of Indepenant Disks (RAID) that is a set of many cheap disks as LVM appear to be one volume, but it saves extra redundant data, there are two types of them hardware (larg case with many disk could be attached using SCSI or USB) or software where a software like Linux kernel modules and user space tools that set usual IDE or SCSI disks (or partitions) to be a RAID system. You may ask how it differ from LVM ? and why on Earth would some one divide hid disk into partitions then join them with RAID ? you will know that when we know RAID levels.

There are some classes of how RAID works called levels, some of them are:

level 0 (stripping), S=sum(s_i)

In this level the array volume is the summation of all disks volumes, data will be distributed (stripped) equally on all disks, for example a 10MB file on a RAID of 10 partitions/disks each will have 1MB.

level 1 (mirroring), S=s₁=s₂...=s_n

The volume of this system equals the volume of only one disk of the set, each disk will be a mirror image of the other, if one is off, busy or facing some inconsistency problems, the whole RAID array will be avaliable.

level 5 (parity checking), S=sum(s_i)-s₁

Like stripping (level 1) data we be distributed on all disks/partition equally except one that is reserved for consistency assurance, the array volume is the summatiton of all volumes except one.